SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,496 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the use of the Get-ADComputer PowerShell cmdlet to enumerate computer information within an Active Directory environment and export the results to a file. This activity is often performed by adversaries during the discovery phase to map out the network.
Detects the creation of a local user account using the 'New-LocalUser' PowerShell cmdlet. This rule specifically looks for the 'New-LocalUser' string within PowerShell script block logs, indicating an attempt to create a new local user on a Windows system.
Detects the usage of COM objects that can be abused to download files within PowerShell scripts by identifying specific CLSIDs. This technique is often used by adversaries for ingress tool transfer or to establish command and control.
Detects the usage of the 'Get-AdComputer' PowerShell cmdlet to enumerate computer objects or their properties within Active Directory. This activity is often performed during the discovery phase of an attack to map out the network environment.
Detects the usage of the "Add-AppxPackage" or its alias "Add-AppPackage" with the "-AllowUnsigned" flag to install unsigned AppX packages. This can be used by adversaries for persistence or defense evasion by installing malicious applications that bypass signature checks.
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocations generated by the Invoke-Obfuscation framework. The rule specifically looks for patterns used by Invoke-Obfuscation to construct the 'IEX' string using character manipulation from PowerShell built-in variables like $PSHome, $ShellId, $env:Public, and $env:ComSpec, as well as other obfuscation techniques like `*mdr*).Name` and `$VerbosePreference.ToString(`.
This rule detects obfuscated PowerShell execution launched via rundll32.exe. It specifically looks for PowerShell script block text containing 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell', which are indicators of the Invoke-Obfuscation framework's RUNDLL LAUNCHER technique. This method is often used for defense evasion and execution of malicious scripts.
Detects obfuscated PowerShell scripts that utilize rundll32.exe, shell32.dll, and shellexec_rundll to execute commands. The rule specifically looks for the presence of '&&', 'rundll32', 'shell32.dll', 'shellexec_rundll' along with keywords like 'value', 'invoke', 'comspec', or 'iex' within PowerShell script block logs. This combination is indicative of techniques used for defense evasion and execution.
Detects PowerShell scripts that read file content, iterate through it, and perform DNS host lookups, potentially for data exfiltration or reconnaissance. This combination of actions is suspicious as it suggests an attempt to process local data and resolve external network information.
This rule detects the use of the PowerShell cmdlet `New-PSDrive` to map a new drive to a remote Windows administrative share (e.g., C$, ADMIN$). This activity is often associated with lateral movement by adversaries who use valid credentials to interact with remote systems over Server Message Block (SMB). The rule specifically looks for the `New-PSDrive` cmdlet, the `-psprovider filesystem` argument, the `-root` argument, and the presence of a UNC path (`\\`) ending with a dollar sign (`$`), which is characteristic of administrative shares.
Page 573 of 680